Microsoft Patch Tuesday March 2026 released

Microsoft 's March 2026 Patch Tuesday brings an extensive package of security updates aimed at fixing 79 different vulnerabilities in the company's ecosystem. Among the issues addressed are two zero-day vulnerabilities that had already been publicly disclosed before an official patch was released, which is increasing the interest of the cybersecurity community.

Critical security gaps and vulnerability categories

In total, the updates this period include three critical vulnerabilities, two of which are related to remote code execution, while the third concerns the disclosure of sensitive information. The bugs are spread across multiple categories, showing how broad the scope of potential attacks is.

Specifically, 46 elevation of privilege vulnerabilities, 18 remote code execution errors, 10 information disclosure vulnerabilities, 4 vulnerabilities that allow Denial of Service attacks, 4 spoofing vulnerabilities and 2 security bypasses.

Patch Tuesday March 2026: Two zero-days in the spotlight

Of particular note are the two zero-day vulnerabilities patched this time. While neither has been confirmed to be actively exploited in real-world attacks, their public disclosure before patches are released increases the risk of potential exploitation.

See also: Microsoft Patch Tuesday February 2026: Fixes for 58 vulnerabilities

The first, codenamed CVE-2026-21262, concerns SQL Server and allows elevation of privilege at the network level. According to the company, an already authorized user could exploit inadequate access controls and gain SQLAdmin, gaining greater control over the system.

The second vulnerability, CVE-2026-26127, is found in .NET and is related to denial of service attacks. Through Out-of-bounds read in .NET, an unauthorized attacker could cause a service outage within corporate networks.

Office vulnerabilities and risks via preview pane

The updates also address two remote code execution vulnerabilities in Microsoft Office (CVE-2026-26110 and CVE-2026-26113). These bugs can even be triggered via the preview pane, meaning a user could be exposed simply by viewing a malicious file.

Of particular interest is the CVE-2026-26144 vulnerability in Microsoft Excel, which could lead to data leakage via Copilot. If successfully exploited, an attacker could cause information to be inadvertently sent over the network by exploiting the way the Copilot Agent works.

What the updates mean for businesses and users

The monthly update process remains a key protection mechanism for organizations and individual users. Security experts emphasize that promptly installing patches significantly reduces opportunities for cyberattacks.

See also: Microsoft Patch Tuesday January 2026: Fix 114 vulnerabilities

At the same time, this Patch Tuesday reminds us that even widely used platforms can harbor vulnerabilities that are discovered months or even years after their release. For this reason, constantly updating systems and applications is considered a critical digital hygiene practice.

Some recent fixes not listed

It's worth noting that the total number of 79 vulnerabilities only includes fixes released with Patch Tuesday. A number of additional security issues in Microsoft services and products were already addressed earlier in the month.

These include bugs affecting Edge, Azure, Mariner, and some internal device billing and payment services. While these fixes were not included in today's patch, they remain important for the overall security of the ecosystem.

The importance of Patch Tuesday in the modern cybersecurity landscape

The well-established Patch Tuesday has evolved in recent years into one of the most important institutions in the cybersecurity field. Every month it attracts the attention of system administrators, researchers, and companies who closely monitor new fixes.

See also: Microsoft Patch Tuesday March 2025: Fixes 57 vulnerabilities

Rapid vulnerability analysis allows IT teams to assess the degree of risk and prioritize the most critical updates. In enterprise environments, this process is often accompanied by compatibility testing before mass deployment.

Recommendations for users and administrators

Experts recommend that users enable automatic updates and install available patches immediately. Especially in cases involving zero-day vulnerabilities or remote code execution errors, delay can create serious defense gaps. At the same time, organizations are urged to maintain backup, threat detection tools, and continuous network monitoringto reduce the risk of new vulnerabilities being exploited. Regular updates remain one of the simplest but most effective protection measures for everyone.

Microsoft Patch Tuesday March: All the vulnerabilities fixed

Source: www.bleepingcomputer.com